rotato

Serverless secret/key rotation into Bitwarden Secrets Manager.

A scheduled Cloud Run job rotates an expiring credential (e.g. a GitLab PAT) and writes the fresh value back to Bitwarden. Every machine then fetches the current value on demand, so the secret is never written to disk and rotations are transparent.

Install

uv tool install rotato      # or: pipx install rotato

Consumer usage (laptop / VM)

Register a secret on the machine, then use it — no repo checkout required.

# a plain token (e.g. a GitLab PAT)
rotato install <secret-uuid> --name gitlab-pat

# a GitHub App private key (a short-lived installation token is minted on use)
rotato install <pem-uuid> --name gh --github --app-id <id> --installation-id <id>

install records the secret (and, on first run, prompts for this machine's read-only Bitwarden token). Then:

rotato print <name|uuid>            # print the usable credential to stdout
rotato list  secrets               # what's installed here
rotato list  rotators              # rotators this build supports

Wire git to an installed secret (writes a credential helper that calls rotato print, so rotations are picked up automatically):

rotato setup gitlab <name> --user <git-user>    # gitlab.com
rotato setup github <name>                      # github.com (App installation token)
rotato setup git    <name> --user <u> --host <h>  # any git host
git -C <a-repo> ls-remote                        # git now authenticates via Bitwarden

Shell completion

rotato supports tab-completion via argcomplete — including installed secret names for print/setup and rotator names for refresh (names only; never secret values).

The register-python-argcomplete generator ships with argcomplete, not rotato, so uv tool install rotato doesn't put it on PATH — install argcomplete as a tool too (once), then register rotato in your shell rc:

uv tool install argcomplete

# bash — ~/.bashrc
eval "$(register-python-argcomplete rotato)"

# zsh — ~/.zshrc (with compinit loaded)
eval "$(register-python-argcomplete -s zsh rotato)"

# fish
register-python-argcomplete -s fish rotato > ~/.config/fish/completions/rotato.fish

Then rotato <tab> lists subcommands, rotato print <tab> lists installed secrets, rotato setup <tab> lists github gitlab git, and so on.

Server side

rotato refresh <rotator-name> runs a rotator (the Cloud Run job entrypoint): read current → rotate at the provider → write back to Bitwarden → verify. ROTATOR env selects the rotator.

Documentation

Full design, invariants, deployment, and "add a rotator" guide: README.org.

License

MIT.

Project links

Data verified by PyPI on Aug 14, 2026
Data provided by the project maintainers, verified at the time the release was uploaded to PyPI.

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for gongzhitaao from gravatar.com gongzhitaao

Credits

Author: Zhitao Gong

GitHub Statistics

Data verified by PyPI on Aug 14, 2026
The GitHub source repository was provided by the project maintainers and verified by PyPI at the time of upload. Stars, forks, and open issues/PRs are derived from that repository and have not been independently verified.

License expression

MIT
View SPDX License List

Requires

Python >=3.12

Tags

bitwarden secrets secret-rotation credentials cli cloud-run

Classifiers

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

rotato-0.3.0.tar.gz (20.1 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

rotato-0.3.0-py3-none-any.whl (25.0 kB view details)

Uploaded Python 3

File details

Details for the file rotato-0.3.0.tar.gz.

File metadata

  • Download URL: rotato-0.3.0.tar.gz
  • Upload date:
  • Size: 20.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for rotato-0.3.0.tar.gz
Algorithm Hash digest
SHA256 3b6ff529c900295bba53cd46676cfc1d737cdc90bacb260d108542b0dcad77e7
MD5 104d70df4e825d35d3d407c640115f0b
BLAKE2b-256 ae399a51f1e6dacc7166ff9384a44c87863d6319da8be0a86ae8a164cc378713

See more details on using hashes here.

Provenance

The following attestation bundles were made for rotato-0.3.0.tar.gz:

Publisher: publish.yml on gongzhitaao/rotato

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

File details

Details for the file rotato-0.3.0-py3-none-any.whl.

File metadata

  • Download URL: rotato-0.3.0-py3-none-any.whl
  • Upload date:
  • Size: 25.0 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? Yes
  • Uploaded via: twine/7.0.0 CPython/3.13.14

File hashes

Hashes for rotato-0.3.0-py3-none-any.whl
Algorithm Hash digest
SHA256 ee9febd971d6d4e433ac0846197c60b1cbb201e6dc3bfafc43de797b1f80eeec
MD5 5032982795fc1543e28a68aa780786c5
BLAKE2b-256 0c86ab73e07c4f2447f2e24f0b4b5ed9bf003b9ca7ed4c7f6a91844cbf621962

See more details on using hashes here.

Provenance

The following attestation bundles were made for rotato-0.3.0-py3-none-any.whl:

Publisher: publish.yml on gongzhitaao/rotato

Attestations: Values shown here reflect the state when the release was signed and may no longer be current.

Release history Release notifications | RSS feed

This release

0.3.0 This release

2 files

0.2.0

2 files

0.1.0

2 files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page